User identifiers become inconsistent
In most cases user identifiers are consistent. I.e. the externalId is sub@iss, whith iss nicely stripped off the leading https:// and stuff.
The EGI guys thought it was a good idea (FAILFAILFAIL!@#!@#) to generate subs that contain an "@" sign.
As a consequence, some component of the adapter becomes confused and uses a strange issuer.
For the moment, the easiest way to look at things is the regapp-tool [1] for these two users:
regapp-tool -i hdf_mhardt
regapp-tool -i hdf_newmarcus22